Privacy Policy
Last updated: 1 August 2026
This policy explains what personal information kiko collects, who sees it, who we send it to, where it is stored and how you can get it changed or deleted. It describes what the kiko system actually does today, not what we might do later.
kiko is run by Jydeon in Sydney, Australia. We aim to handle personal information consistently with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Contact: safety@kiko.jydeon.com.
1. What we collect
If you join the waitlist
From the kiko website: your first name, your mobile number, your postcode if you enter it, a tag recording which sign-up link or QR code you used (for example which event or suburb), and the date and time you signed up.
If you create an account
| Information | Why we have it |
|---|---|
| Mobile number | Your login, and how we text you codes and match updates. Required. |
| Email address | Verified during signup; used to reach you. |
| First name | Shown to your matches. |
| Date of birth | To confirm you are 18+ and to work out your age, which is shown to matches. |
| Gender and orientation | Matching. |
| Height | Matching and preferences. |
| Postcode and city | To match you with people nearby and pick a venue. |
| Instagram and LinkedIn handles, if you give them | Optional. Used by our matchmakers when reviewing your profile. |
| Up to five photos, and which one is your match photo | Used by our matchmakers, and to generate your cartoon. |
| Your AI-generated cartoon | This is what your matches see. |
| Your availability — which days and times you are free | To schedule dates. |
| An intro call time, if you book one | Scheduling. |
| Your preferences: age range, height range, preferred ethnicities, dealbreakers, and a free-text description of your ideal partner | Matching. The free-text field is read by a human matchmaker. |
| A push notification token from your device, if the app registers one | Stored so we can send app notifications. Today we send updates by SMS. |
| Account timestamps: when you signed up, when you last signed in, and whether your account is active | Running the service. |
About your matches and dates
Who you were matched with, the time and venue of the date, whether each of you accepted, whether a date was cancelled and the first name of whoever cancelled it, and the answers you give when you rate a date afterwards.
Sign-in codes
When we send you a one-time code we store the code in hashed form — not the code itself — against your phone number or email, with an expiry of 10 minutes. Old codes are cleaned up. We limit how many codes can be requested per hour.
2. Sensitive information
Some of what you give us is sensitive information under Australian privacy law — in particular your sexual orientation, and the ethnicity preferences you set. We collect these because they are necessary to match you, and by entering them you consent to us using them for that purpose. Our human matchmakers can see them.
3. A human matchmaker reads your profile
This is central to how kiko works. kiko does not match people automatically. Staff on our team use an internal admin tool and can see your full profile: your name, age, gender, orientation, postcode, your phone number, your email address, your uploaded photos, your Instagram and LinkedIn handles, your availability, your preferences, your dealbreakers and your free-text description of your ideal partner.
The admin tool is protected by a separate admin key and is only used by people running kiko.
4. What other users see about you
When you are matched with someone, the app shows them only:
- your first name
- your age
- your gender
- your cartoon
Your real photos are never shown to other users through the app. Neither is your phone number, your email address, your date of birth, your postcode, your socials or your preferences. They also see the time and venue of the date, and whether you have accepted it. If you cancel, the other person is told a date fell through.
5. Your photos and the cartoon — read this bit
Your match photo is sent to Google
When you choose your match photo, kiko sends that photo to Google's Gemini image service, which generates the cartoon. Your face leaves kiko's systems and is processed by Google on Google's infrastructure, which is outside Australia. Google's handling of that image is governed by Google's own terms and privacy policy, not ours. If you are not comfortable with this, do not upload a photo — but note the cartoon is required to be matched.
Photo storage is by unlisted public link
Your photos and your cartoon are stored in Cloudflare R2 and served from a public web address. That address is not password-protected: anyone who has the exact link can open the image without logging in to kiko.
The links contain a long random identifier, so they cannot realistically be guessed, and we do not publish them. But they are not access-controlled, and they do not expire. We are telling you this plainly rather than describing the storage as private, because it is not. Please treat any photo you upload as something that could be viewed by someone who obtains the link.
6. Who else receives your information
| Service | What it receives |
|---|---|
| Twilio | Your mobile number and the content of the SMS we send you — sign-in codes, and match messages containing your match's first name and age plus the date time and venue. |
| SendGrid | Your email address and the verification email we send you. |
| Cloudflare R2 | Stores your photos and your cartoon, as described above. |
| Google (Gemini) | Your chosen match photo, to generate the cartoon. |
| Google Cloud | Hosts the kiko application and database. |
We do not sell your personal information, and we do not send it to advertisers or data brokers. We may disclose information if we are required to by law, or where we reasonably believe it is necessary to prevent serious harm to someone.
7. Where your information is stored
The kiko application and its database run on Google Cloud in the australia-southeast1 (Sydney) region, so your profile and match records are stored in Australia.
The services listed above are overseas providers and may store or process information outside Australia, including in the United States. That applies to your phone number and message content (Twilio), your email address (SendGrid), your photos and cartoon (Cloudflare), and your match photo (Google). We have not restricted these providers to Australian-only processing.
8. Security — what we do and do not do
What we do today:
- Traffic between the app and our server uses HTTPS.
- Sign-in codes are stored hashed, expire after 10 minutes, and are rate limited.
- Sign-in sessions use signed tokens that expire.
- The matchmaker admin tool requires a separate admin key, and is turned off entirely if that key is not configured.
- We rely on the built-in protections of Google Cloud and Cloudflare for the storage underneath.
What we do not currently do, stated honestly:
- We do not apply our own additional encryption to profile fields in the database beyond what our hosting provider does by default.
- Photos are served from unlisted public links rather than access-controlled ones (see section 5).
- No system is perfectly secure and we cannot guarantee your information will never be accessed improperly.
9. How long we keep it, and what deleting your account really does
When you delete your account in the app, here is exactly what happens today: your account is deactivated. You are excluded from matching, your details stop being shown to anyone, and your phone number is renamed in our database so it no longer works as a login and frees the number for future use.
Your record is not automatically erased at that point, and your uploaded photos and cartoon are not automatically removed from Cloudflare R2 — the links to them keep working. Full erasure is done by us manually.
If you want everything erased, including your photos, email safety@kiko.jydeon.com and ask us to erase your data. We will do it and confirm when it is done.
We keep waitlist entries until we have launched in your area or you ask us to remove you. We keep match and date records while both accounts are active so the service works. Sign-in codes are deleted shortly after they expire.
10. Getting access to your information, or correcting it
You can see most of your own profile in the app. You can ask us for a copy of what we hold about you by emailing safety@kiko.jydeon.com, and we will respond within 30 days.
Some details are locked in the app once you finish signup — your first name, date of birth, gender, orientation, height and postcode — and your email address cannot be changed in the app once verified. Email us and we will correct them for you.
11. Analytics and tracking
The kiko website does not load any third-party analytics, advertising or tracking scripts, and does not set tracking cookies. Our servers and our providers keep ordinary technical logs of requests.
12. Children
kiko is for people aged 18 and over. The app rejects a date of birth that makes you under 18, but we do not verify age against identity documents. If we learn we hold information about someone under 18, we will deactivate the account and delete their information.
13. Complaints
If you think we have mishandled your personal information, email safety@kiko.jydeon.com with the details. We will acknowledge your complaint and aim to respond within 30 days.
If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
14. Changes to this policy
We may update this policy. If a change is significant we will tell you in the app or by SMS or email. The date at the top shows when it was last updated.
15. Contact
Privacy questions, access requests, erasure requests and complaints: safety@kiko.jydeon.com.